This vulnerability in Tenda HG3 2.0 involves improper handling of the 'datasize' argument in the formTracert function located at /boaform/formTracert. An attacker can manipulate this argument to inject and execute arbitrary commands on the affected device remotely. The CVSS 4.0 base score is 8.7, indicating a high severity with network attack vector, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. The vulnerability is publicly disclosed but lacks an official fix or vendor advisory at this time.

Successful exploitation allows an unauthenticated remote attacker to execute arbitrary commands on the affected Tenda HG3 device, potentially leading to full compromise of the device. This can impact confidentiality, integrity, and availability of the device and its network environment. No known exploits in the wild have been reported yet.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the device management interface from untrusted networks and monitor for suspicious activity related to the formTracert function. Do not expose the device management interface directly to the internet.